Algorithms for Adversarially Robust Deep Learning

2025-09-23

AI Summary

This work addresses robustness challenges of deep learning models in safety-critical applications, tackling three adversarial threats: (1) adversarial examples in computer vision, (2) out-of-distribution generalization (i.e., domain generalization), and (3) jailbreaking attacks against large language models (LLMs). We propose a unified robustness enhancement framework comprising: (i) a certifiably robust defense against adversarial perturbations; (ii) a cross-domain robust training paradigm grounded in out-of-distribution generalization and invariant representation learning; and (iii) an LLM jailbreaking defense integrating formal verification with prompt-attack modeling. Our approach synergistically combines adversarial training, invariance regularization, verification-driven optimization, and controllable decoding. Evaluated on medical image analysis, molecular structure recognition, and standard image classification benchmarks, it achieves state-of-the-art generalization performance. Moreover, it significantly improves jailbreaking resistance across multiple open-source LLMs, demonstrating effectiveness and scalability in multimodal and multi-task settings.

Technology Category

• Machine Learning: Adversarial Learning & Robustness
• Computer Vision: Adversarial Attacks & Robustness
• Natural Language Processing: Safety and Robustness

Application Category

• Search and Retrieval-Augmented AI: Search Tool Learning with LLM: Teaching LLMs to invoke search and make use of retrieved information
• Security and Privacy: Security and privacy of machine learning and AI applications
• Semantics and Knowledge: Methods to enhance, augment, integrate or synergize semantic models such as knowledge graphs and LLMs

Abstract

Given the widespread use of deep learning models in safety-critical applications, ensuring that the decisions of such models are robust against adversarial exploitation is of fundamental importance. In this thesis, we discuss recent progress toward designing algorithms that exhibit desirable robustness properties. First, we discuss the problem of adversarial examples in computer vision, for which we introduce new technical results, training paradigms, and certification algorithms. Next, we consider the problem of domain generalization, wherein the task is to train neural networks to generalize from a family of training distributions to unseen test distributions. We present new algorithms that achieve state-of-the-art generalization in medical imaging, molecular identification, and image classification. Finally, we study the setting of jailbreaking large language models (LLMs), wherein an adversarial user attempts to design prompts that elicit objectionable content from an LLM. We propose new attacks and defenses, which represent the frontier of progress toward designing robust language-based agents.

Problem

• Developing robust deep learning algorithms against adversarial exploitation in safety-critical applications
• Training neural networks to generalize from training distributions to unseen test distributions
• Designing defenses against jailbreaking attacks that elicit objectionable content from LLMs

Innovation

• Adversarial training paradigms and certification algorithms
• Domain generalization algorithms for unseen distributions
• Attacks and defenses for jailbreaking large language models